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BSA | The Software Alliance (BSA) welcomes the opportunity to submit comments on the draft India 
Data Accessibility and Use Policy (Draft Policy) to the Ministry of Electronics and Information 
Technology (MeitY). ' 


BSA is the leading advocate for the global software industry. Our members are among the world’s 
most innovative companies, creating software solutions that help businesses of all sizes in every part 
of the economy to modernize and grow.? Many of BSA’s member companies have made significant 
investments in India, and we are proud that many organisations and consumers from India continue to 
rely on our members’ products and services to support the Indian economy. 


Government-generated data is an important asset that can serve as a powerful engine for creating 
new jobs, promoting economic growth, and enabling innovation. We therefore welcome the Draft 
Policy and the sound foundation upon which it is built. Specifically, we appreciate the Draft Policy’s 
focus on improving the institutional framework for government data sharing, promoting principles 
around privacy and security by design, establishing an open by default approach, protecting 
intellectual property rights, encouraging the use of anonymization tools and ensuring equitable access 
to government data for both the public and private sector. 


In our submission, we share recommendations that are intended to help achieve the Draft Policy’s 
goal of “catalysing large scale social transformation” by enhancing the use and availability of public 





1 MeitY India Data Accessibility and Use Policy, accessible at: 
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sector data. Effective open data policies can enhance the collective benefits of data by facilitating 
greater sharing, collaboration, and experimentation while protecting privacy and security.* 


Our recommendations to the Draft Policy are as follows: 
1. Promote greater open data sharing while safeguarding privacy 


The Draft Policy aims to promote the availability of non-sensitive government data by establishing an 
“open by default” policy. Pursuant to the Draft Policy, government ministries and departments will be 
encouraged to audit their existing data resources to create a comprehensive inventory. As part of that 
process, ministries and departments will classify data resources as “open,” “restricted,” or “negative 
list’. Datasets deemed “open” will be made open by default on the Open Government Data Portal. 
Data deemed “restricted” will be shared only through a prescribed process with trusted users defined 
by concerned departments under a controlled environment.® And, datasets that are under the 
“negative list” will not be shared. The Draft Policy’s approach is sensible, establishing an “open by 
default” policy for most non-sensitive and non-personal data assets, while leaving open the possibility 
of sharing “restricted” in special circumstances. 


But the success of the Draft Policy will depend on whether government departments are provided with 
clear guidance on how to appropriately determine whether data assets should be categorized as. The 
Draft Policy indicates that such guidance will be provided through a “Data Sharing Toolkit” and in 
guidance “protocols” from the India Data Office (IDO). It is imperative that the Data Sharing Toolkit 
and guidance protocols provide clarity and incentives for government departments to make non- 
sensitive public sector data available by default. This could include providing guidance on appropriate 
protections and limitations of liability for government ministries and departments that share non- 
sensitive and restricted datasets in good faith. 


The Data Sharing Toolkit and IDO Protocols should also provide guidance to encourage the adoption 
of standardized data licensing approaches. One major source of friction currently impeding the private 
sector’s use of government data globally is the inconsistent licensing practices that ministries and 
departments use to make their data available to the public, making it difficult to use government data. 
Ministries and departments currently make their data available under a variety of terms, conditions, 
and use restrictions that can undermine efforts to make robust use of government data. The problems 
are compounded when a project requires use of data from multiple ministries and that may be subject 
to a thicket of varying terms and conditions. To enhance the value of government data, MeitY should 
explore options for adopting standardized data sharing agreements for use across government 
ministries and departments, as well as the private sector. The value of a standardized government 
data sharing agreement will be enhanced if it is consistent with emerging best practices and industry 
standards. MeitY should therefore consider the adoption of a data license model already in use by the 
Al developer community, such as the Linux Foundation’s Community Data License Agreement® 
and/or the Open Use Data Agreement.’ Regardless of the model, MeitY should ensure that 
government data assets are not subject to unnecessary restrictions on use, particularly for datasets 
classified as “open”. 





3 Para 2, MeitY India Data Accessibility and Use Policy. 

4 BSA Open Data Agenda, accessible at: https://www.bsa.org/files/policy-filings/061120bsaopendata.pdf 

5 Para 7, MeitY India Data Accessibility and Use Policy. 

ê The Linux Foundation Projects, Community Data License Agreement, https://cdla.io/. 

7 Microsoft, The Open Use of Data Agreement, httos://github.com/microsoft/Open-Use-of-Data-Agreement. 


Le-Meridien P (91 11) 4978 9066 
15th Floor, Room 1529 W bsa.org 

Windsor Place, Janpath 

New Delhi 110001 


In addition, promoting the availability of data sharing tools and resources and promote the adoption of 
best practices that make it easier and less expensive to share data in ways that are consistent with 
rigorous privacy expectations. Technical tools, such as Application Programming Interfaces (APIs), 
can facilitate data exchanges that are fast and secure, if implemented properly. Promoting them within 
the Data Sharing Toolkit can create opportunities for empowering the public with greater access to 
their own data. 


Notably, citizens regularly share data with the Government to access public services, to improve 
governance, and to enhance innovation. While the Policy focuses on the use of anonymisation tools, 
along with a principled push towards ensuring privacy, significant concerns remain in the absence of a 
dedicated and robust privacy legislation. In 2017, the Supreme Court of India in the case of 
Puttuswamy v. Union of India declared that the right to privacy is a fundamental right protected under 
the Constitution of India. The Draft Policy should safeguard privacy requirements while promoting 
greater open data sharing 


2. Include appropriate safeguards to address concerns about privacy, security, 
intellectual property, consumer protection, and competition 


Section 5 of the Draft Policy highlights a collection of data sharing and governance principles that are 
commendable. For instance, BSA appreciates that the Draft Policy recognises principles around 
privacy and security by design, intellectual property and ownership rights over data.? We recommend 
that MeitY should clarify that these principles are to be taken into consideration in determining the 
classification of datasets. Consistent with our recommendation above, the India Data Office (IDO) 
should be directed to develop guidance for departments and ministries to make dataset classification 
decisions. The basis of such guidance should be built from the data sharing principles in Section 5. 


3. Promote privacy enhancing technologies and data governance structures 


Pursuant to Section 12 of the Draft Policy, ministries and departments will be provided with guidance 
on anonymisation tools. We applaud the Draft Policy’s reference to anonymization tools to preserve 
privacy in data sharing arrangements. 1° In addition to anonymization tools, we encourage MeitY to 
ensure that ministries and departments are also provided with guidance and resources to help them 
leverage “privacy enhancing technologies.” 11 Emerging technologies like homomorphic encryption, 
differential privacy techniques, and federated machine learning can create opportunities for data 
sharing while preserving individual privacy. These technologies can be used to maximize both the 
value and the confidentiality of sensitive information and would be particularly relevant to help 
facilitate the sharing of data assets that are deemed “restricted.” Similarly, MeitY should encourage 
ministries and departments to consider opportunities for leveraging innovative data governance 
structures—such as data trusts, data cooperatives, and data commons—that facilitate public and 
private sharing of data in ways that preserve privacy while enabling participants to benefit from the 
analysis of potentially sensitive data. 


4. Ensure active industry participation 


The Draft Policy draws out a comprehensive institutional framework to ensure effective government 
data sharing. This includes the set-up of an IDO to streamline and consolidate data access and 
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sharing of public data across government departments; and the India Data Council (IDC) to perform 
key governance functions such as defining High Value Datasets, data and meta-data standards, 
reviewing the implementation of the policy, among others. ‘'? In addition, every government department 
will also create Data Management Units headed by Chief Data Officers (CDO).'? We commend this 
approach — while individual CDOs will help maximize the value of data within each individual 
government department, ensuring interoperability within the government through the IDO and the IDC 
will deliver a consistent approach to data governance. 


However, the set-up proposed in the Draft Policy does not contemplate any industry participation or 
collaboration. This is concerning, since identifying the data assets that would be valuable to the 
private sector can prove difficult. We recommend that the Draft Policy should establish a public- 
private advisory council to provide recommendations to the IDC about data that would be most 
impactful to the public, industry, and government. By bringing together experts from the government, 
civil society, and industry, such a council will create a mechanism for ensuring that government data 
is published with purpose and that ministries and departments are prioritizing the release of data 
assets with the greatest potential for positive impact. 


5. Modernize IT infrastructure to support data sharing 
The ability to deliver on the Draft Policy’s vision to leverage government data for social transformation 
will ultimately depend on whether government ministries and departments have the resources and 
infrastructure they need to make effective use of data. Reliance on aging physical data centres can 
result in data siloes that prevent departments from making use of data outside of the application the 
department used to generate it and make it exceedingly difficult to share with the public. 
To that end, we recommend that the Draft Policy be supported by efforts to modernize the 
government's IT infrastructure through the adoption of commercial cloud offerings and best-in-class 


software solutions. 


Thank you again for the opportunity to comment on the Draft Policy. If you require further information 
in respect of this submission, please contact Mr. Venkatesh Krishnamoorthy at venkateshk@bsa.org. 


Sincerely, 
BSA | The Software Alliance 


Annexure: BSA Open Data Agenda 
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13 Para 6.2, MeitY India Data Accessibility and Use Policy. 
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